DNSPKTFLOW(1)

📦 version 2.2.3, in arch rolling

💖 NAME 💖 — DNSPKTFLOW(1) bestie manual 💖

okay so welcome to the DNSPKTFLOW(1) page from User Contributed Perl Documentation! The command is dnspktflow — analyze and draw DNS flow diagrams from a tcpdump file. Periodt. 💅

✨ SYNOPSIS ✨

dnspktflow -o output.png file.tcpdump

dnspktflow -o output.png -x -a -t -q file.tcpdump

🦋 DESCRIPTION 🦋

okay so here’s the tea: the dnspktflow app takes a tcpdump network traffic dump file, runs it through the tshark app, and then shows the resulting DNS packet flows in a “flow-diagram” image. Iconic behavior, honestly. 💖

dnspktflow can output a single image or a series of images which can then be shown in sequence as an animation. Little slideshow moment. 🎬✨

dnspktflow was written as a debugging utility to help trace DNS queries and responses, especially as they apply to DNSSEC-enabled lookups. Main character debugging energy fr fr. 👑

🌈 REQUIREMENTS 🌈

This application requires the following Perl modules and software components to work:

The following is required for outputting screen presentations:

If the following modules are installed, a GUI interface will be enabled for communication with dnspktflow:

  • QWizard — Perl module
  • Getopt::GUI::Long — Perl module

💅 OPTIONS 💅

dnspktflow takes a wide variety of command-line options. These options are described below in the following functional groups: input packet selection, output file options, output visualization options, graphical options, and debugging. Basically a whole closet, bestie. 🫶

📥 Input Packet Selection 📥

These options determine the packets that will be selected by dnspktflow.

  • -i STRING, --ignore-hosts=STRING — a regular expression of host names to ignore in the query/response fields.
  • -r STRING, --only-hosts=STRING — a regular expression of host names to analyze in the query/response fields.
  • -f, --show-frame-num — display the packet frame numbers. 🔢
  • -b INTEGER, --begin-frame=INTEGER — begin at packet frame NUMBER.

📁 Output File Options 📁

These options determine the type and location of dnspktflow’s output.

  • -o STRING, --output-file=STRING — output file name (default: out%03d.png as PNG format.)
  • --fig — output format should be fig.
  • -O STRING, --tshark-out=STRING — save tshark output to this file.
  • -m, --multiple-outputs — one picture per request (use %03d in the filename.)
  • -M STRING, --magic-point=STRING — saves a MagicPoint presentation for the output.

🌀 Output Visualization Options: 🌀

These options determine specifics of dnspktflow’s output.

  • --layout-style — selects the graphviz layout style to use (dot, neato, twopi, circo, or fdp).
  • -L, --last-line-labels-only — only show data on the last line drawn.
  • -z INTEGER, --most-lines=INTEGER — only show at most INTEGER connections.
  • -T, --input-is-tshark-out — the input file is already processed by tshark.

🎨 Graphical Options: 🎨

These options determine fields included in dnspktflow’s output.

  • -t, --show-type — shows message type in result image.
  • -q, --show-queries — shows query questions in result image.
  • -a, --show-answers — shows query answers in result image.
  • -A, --show-authoritative — shows authoritative information in result image.
  • -x, --show-additional — shows additional information in result image.
  • -l, --show-label-lines — shows lines attaching labels to lines.
  • --fontsize=INTEGER — Font Size.

🐛 Debugging: 🐛

These options may assist in debugging dnspktflow.

  • -d, --dump-pkts — dump data collected from the packets.
  • -h, --help — show help for command line options.

Copyright 2004-2013 SPARTA, Inc. All rights reserved. See the COPYING file included with the DNSSEC-Tools package for details.

🫶 AUTHOR 🫶

Wes Hardaker <hardaker@users.sourceforge.net>

🔥 SEE ALSO 🔥

okay bestie, that’s the whole page — brought to you by perl v5.44.0, dated 2026-10-17, signed off with maximum sparkle. mwah 💋✨

📦 where this page comes from